Article content

“I was unfaithful to my wife,” Nvidia’s Jensen Huang admitted. Why the scandal shows that blocking chip sales to China won’t stop the AI race, and what might.

By Not Nulled Labs. A Hybrid Core editorial experiment.

June 2024. A bar in Taipei during Computex week. An executive from a Singapore data centre company bets a group of colleagues that she can get Jensen Huang to show up. A little later, Nvidia’s CEO walks in wearing his trademark leather jacket. One of the people at the table later told the story to The New York Times, and a photo of the evening made the rounds on LinkedIn.

The executive is Alice Huang, also known as Huang Le. She shares a surname with Nvidia’s CEO but they are not related. According to the Times, she spent much of her career in mainland China, including a stint as a reporter for Chinese state television. Her company, Megaspeed, had just committed to buying around US$2 billion worth of Nvidia hardware. Later reports put the purchases of a sister company in Malaysia at no less than US$4.8 billion in equipment built on Nvidia technology between June 2024 and February 2026. These were top-of-the-line chips, not the cut-down versions Washington allows China to buy.

nvidia spy china

Two years on, the story took a very different turn. The Times reported that US intelligence had concluded Alice Huang was recruited by the Ministry of State Security, China’s main spy agency. Her assignment, according to those sources, was to gather information on Jensen Huang and, if possible, persuade him to lobby Washington to let Nvidia sell its most advanced chips to China.

On Sunday 8 November, the most powerful man in the hardware business, married for 41 years, sent a letter to his entire company. “I was unfaithful to my wife,” he wrote, and apologised to his family, his colleagues and his shareholders. That same evening, Nvidia’s board announced an independent investigation into any national security risks.

“I was unfaithful to my wife. There is no excuse for what I did.”

Jensen Huang, letter to Nvidia employees

On Monday, Donald Trump said he had spoken to Huang by phone and that Huang told him he had no idea she was a spy. The president said he believed him and called him an honourable man.

It reads like the plot of a streaming series. But behind the gossip sits a far more serious problem. The technology wall the United States has built around China has side doors. They run through Singapore and Malaysia and, if Washington is right, through the private life of the man who makes the chips.

Eleven days that shook Nvidia

It took less than two weeks to go from “nothing unusual” to “I was unfaithful”.

29 Oct. The New York Times reports that US intelligence monitored Alice Huang for at least a year and regards her as a Chinese asset. Jensen Huang tells Bloomberg that Nvidia’s dealings with Megaspeed were normal and that the company counted every GPU it deployed.

30 Oct. Beijing dismisses the report as groundless speculation. The Wall Street Journal adds that officials in Taiwan and Singapore share the concern.

31 Oct. Singapore says it has not investigated Alice Huang herself, although its case against Megaspeed remains open.

4 and 5 Nov. Three Republican committee chairs in the House of Representatives invite Huang to a closed-door briefing on 18 November.

6 Nov. The Times reports that the Ministry of State Security recruited her. The Financial Times reveals a government memo describing a romantic relationship. Nvidia declines to comment.

8 Nov. Huang admits the affair in a letter to staff. The board opens an investigation and says it has confidence in him.

9 Nov. Trump says he spoke to Huang, who denied knowing she was a spy, and that he believes him.

What makes the case most awkward for Washington is that the accounts don’t line up. Axios reports that Secretary of State Marco Rubio warned senior officials about the relationship. According to the Times, the memo circulated among top policymakers last spring, and Trump was briefed last year without taking action. Trump says he only just found out. And Jensen Huang never received the defensive briefing that agencies usually give Americans they know are being targeted by a foreign intelligence service.

Set the romance aside and the business side is well documented. Megaspeed was spun off in 2023 from 7Road, a Chinese gaming and cloud company with state-linked investors. It bought most of its hardware through Aivres, the US arm of Inspur, a Chinese group sanctioned for supplying supercomputers to the military. In late 2024, Commerce Department inspectors visited its Malaysian facility and found GPUs still sealed in their boxes. Singapore police confirmed an investigation, and Megaspeed stopped placing orders in mid-2025.

The juiciest parts, however, remain unproven. Whether Alice Huang really is an agent, whether she obtained anything from Nvidia, whether Jensen knew anything at all: all of it comes from anonymous intelligence sources, with no public evidence. China denies it. Nvidia insists its customers receive no sensitive information and that none of them ever asked its CEO to lobby on their behalf.

In the trade, getting close to a target through intimacy has a name, the honey trap, and it is one of the oldest techniques in espionage. It gets what no wiretap ever can, which is the target’s trust.

Which leaves an uncomfortable question. If the goal was to get Huang to push for chip sales to China, the outcome is plain to see. Huang pushed, and in December 2025 Trump cleared the H200 for export. There is no evidence that one led to the other. Huang had been arguing publicly for sales to China long before, and the lobbying has an obvious commercial motive. Still, when the person with the most sway over a national security policy is keeping a secret that, according to Washington, a foreign intelligence service knew about, the problem is no longer just his marriage.

This article does not treat the espionage claims as proven. It doesn’t need to. Even if Alice Huang turned out to be nothing more than a well-connected businesswoman, the Megaspeed case is enough to make the argument that follows.

Three ways around a blockade

The current rules are simple enough on paper. Nvidia’s most advanced chips, the Blackwell and Rubin families, cannot be sold to China. Since January 2026, the H200, from the older Hopper generation, can be licensed case by case, subject to third-party testing in the United States and a 25% cut of each sale for the US Treasury. In other words, China has official access to what the rest of the world was using two generations ago.

The irony is that Beijing is now the one holding back. According to Reuters, some 600,000 H200 units are sitting in Hong Kong because the Chinese government won’t approve large-scale imports. It would rather push its companies towards home-grown hardware.

The real problem is that export controls govern where a chip is shipped, not where its computing power ends up being used. And computing power today is a service delivered over the internet. To train a model, the GPU doesn’t need to be in Shanghai. A warehouse in Johor or Jakarta will do, as long as someone pays the bill.

The Megaspeed case shows all three side doors at once:

  • Renting. Data centres in Malaysia and Indonesia that, according to the Times, appear to serve customers in China remotely. That isn’t necessarily illegal, unless it is done on behalf of a Chinese company.
  • The middleman. The US subsidiary of a sanctioned group can buy legally and resell to a third party in Singapore. Two hops, and the chip is on the other side of the rule.
  • Smuggling. Experts quoted by the Times estimate that illegal networks have moved perhaps hundreds of thousands of restricted chips into China. On the grey market, Blackwell servers are offered for more than 20 million yuan apiece.

chip route megaspeed

None of these doors requires a spy. All they need is demand, money and a rule written for a world where hardware stayed where it was installed.

The day Nvidia lost US$589 billion

On 27 January 2025, Nvidia shed around US$589 billion in market value in a single session, the biggest one-day loss for any company in Wall Street history. The trigger was a little-known Chinese lab, DeepSeek, which had trained a competitive model on H800 chips, the restricted versions made for China, with a declared compute bill of under US$6 million.

For the people who designed the sanctions, it was an uncomfortable lesson. A lab that can’t buy more computing power learns to squeeze more out of what it has, and the restriction ends up working as a research agenda.

Eighteen months later, the story repeated itself with DeepSeek V4. It is a huge model that switches on only a small fraction of itself for each query, does its maths at lower precision to save resources, and runs on both Nvidia GPUs and Huawei’s Ascend chips. A Huawei-led report published in July documented the final stage of its training on Chinese hardware, with close to three times the efficiency of the baseline approach.

Not all of it is home-grown, though. Scarcity also creates an incentive to copy. In February 2026, Anthropic accused DeepSeek, Moonshot and MiniMax of using around 24,000 fraudulent accounts to generate more than 16 million exchanges with Claude and train their own models on the answers. Eleven days earlier, OpenAI had sent similar allegations to the House Select Committee on China. In September, Anthropic expanded the list to seven labs, including Alibaba, Zhipu and Xiaomi.

According to the same report, Moonshot quietly routed some of its own customers’ queries to Claude and served the answers as if they came from its Kimi model. DeepSeek did something similar in July. Users thought they were talking to a Chinese AI while, without knowing it, they were feeding a copy of an American one.

Distillation, training a small model on the outputs of a larger one, is a legitimate technique that every lab uses on its own models. And the entire industry was built by reading other people’s content on the internet. What sets these cases apart is the method: fake accounts, stolen cards and terms-of-service violations on an industrial scale.

Closing the front door produced a mix of ingenuity and freeloading, and Washington wanted neither.

Yes, sanctions work. They buy time

It would be just as unfair to say the restrictions achieve nothing.

Pre-training frontier models still depends heavily on Nvidia hardware. A Tsinghua University professor told MIT Technology Review that DeepSeek appears to have moved only part of V4’s training onto domestic chips. Earlier tests put the Ascend 910C at around 60% of an H100’s inference performance. And a project that relies on smuggled chips is expensive and hard to scale.

Sanctions impose a cost and buy time, but they don’t stop the race. They also speed up something Washington never wanted, which is China building its own hardware and software stack, from Ascend chips to CANN, its answer to Nvidia’s CUDA. Huawei is aiming to ship 750,000 Ascend chips this year, and Beijing can now afford to leave H200s gathering dust in Hong Kong.

Trading a few months of lead for an independent competitor is a debatable bargain. On top of that, none of these measures makes artificial intelligence any safer. They only decide who reaches the same cliff edge first.

You can seduce a CEO. An inspector is harder

In April 2025, the AI Futures Project, led by former OpenAI researcher Daniel Kokotajlo, published AI 2027, a detailed scenario of how the world might arrive at superhuman artificial intelligence. The authors have since pushed their timeline back, but the dynamic they describe still holds. In their story, competition between the United States and China pushes both sides to cut corners on safety, China steals the weights of a leading model, and international treaties are shelved because each government prefers its own advantage. The scenario has two endings, a race and a slowdown, and the race ends badly for everyone.

In July 2026, the same team moved from forecasting to proposing with AI 2040 and its “Plan A”. The core idea is a verified agreement between the United States and China to halt frontier model training, make research transparent and spread capability across many companies and countries instead of concentrating it in a single winner. It would start with the two superpowers but would eventually need every country with a significant AI programme or a link in the chip supply chain. Kokotajlo argues verification is feasible. Roughly 99% of the relevant compute sits in large, declarable data centres, and the monitoring hardware would add somewhere between 0.1% and 1% to the cost of each new facility.

The Alice Huang story exposes the weakness of any control system that relies on the discretion of a handful of powerful people. A CEO can be seduced, pressured or persuaded. An inspector counting chips in a data centre, with colleagues from other countries checking the work, is a much harder target.

A CEO can be seduced, pressured or persuaded. An inspector counting chips is a much harder target.

Starting from there, we think a sensible framework would have five parts:

  1. An international verification body. Something along the lines of the International Atomic Energy Agency, with inspectors from different blocs and no single government holding a veto over the rest.
  2. A compute registry. Every data centre above a certain size declares how many accelerators it runs, where they are and who they work for. Chips include location verification, so that a warehouse in Malaysia can’t become anyone’s invisible branch office.
  3. Model safety audits. Independent evaluations before any frontier model is deployed, with public results, regardless of the country where it was trained.
  4. Compute quotas by region. A transparent allocation that guarantees access for countries currently watching the race from the stands: Argentina, Brazil, Mexico, much of Africa and Southeast Asia.
  5. Common rules for model access. Identity checks for high-volume use, so that fraudulent distillation stops being a cheap shortcut.

Quotas sound radical until you remember they already exist. In January 2025, the Biden administration published a framework that sorted countries into tiers with caps on chip imports, and the Trump administration scrapped it months later in favour of bilateral deals. The quotas are there. They are simply set by one country, and they change with every administration.

So, are we being naive?

Probably a little, and the objections are serious.

China is unlikely to accept foreign inspectors in its data centres. The United States is unlikely to give up the leverage that comes from controlling Nvidia, TSMC and much of the supply chain. A global body could be captured or become bureaucratic just as the technology accelerates. And badly designed quotas could lock in the very inequality they are meant to fix.

But there is precedent. During the Cold War, two rivals with nuclear missiles pointed at each other signed treaties with mutual inspections, because the alternative was worse for both. AI 2027 makes the same point: large data centres are hard to hide, which makes them verifiable. Kokotajlo doesn’t present his Plan A as an elegant solution. He presents it as the least bad plan he knows of.

Sanctions have a political advantage, because they can be announced at a press conference. A verification system is the opposite, slow technical work that never makes the headlines. But the Megaspeed case shows what happens when security depends on nobody buying chips through a subsidiary, nobody renting a server in Malaysia and no CEO falling for the wrong person.

From Latin America, we watch this race from the outside. We don’t make chips or train frontier models, but we will live with whatever comes out of it. So the question that matters to us isn’t who gets there first. It’s whether anyone will be watching when they do.

 

References